b0e39bd1138235206c2f4af16892000b054493fd9a4775e5fe5ceb32e3123bbb

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 22:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

966a35cf0125a7c8e91d3aabc08fa276_JaffaCakes118.html
Size

37KB
MD5

966a35cf0125a7c8e91d3aabc08fa276
SHA1

765eaa5b8ed15659da4d62b10d3fa75da11ac5ba
SHA256

b0e39bd1138235206c2f4af16892000b054493fd9a4775e5fe5ceb32e3123bbb
SHA512

7eeeea9ed2b0494c6bc24c93cffe8c0ec9b7f582ed8e85234c60a01d977cd5628430786ac308f25002fa5e0a80db3340cfc20fe85ec91e3098704b02f475668a
SSDEEP

192:uw7ab5nKenQjxn5Q/dnQieANn5nQOkEntXDnQTbnxnQOg/cwqY+cwqYicwqYQuKy:BQ/ofOY5uKMlmsF7n/iy

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B38C07A1-22BE-11EF-852B-6265250A2D3F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423700663"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2064	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2064	iexplore.exe
2064	iexplore.exe
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 2148	2064	iexplore.exe	28
PID 2064 wrote to memory of 2148	2064	iexplore.exe	28
PID 2064 wrote to memory of 2148	2064	iexplore.exe	28
PID 2064 wrote to memory of 2148	2064	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\966a35cf0125a7c8e91d3aabc08fa276_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2064 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d9a298bc62627e5e42c92ecbe50f354

SHA1
524f285eb72d8c29cb273cceab0e3b1866c6bbae

SHA256
77b0abb387baf775aa444b364602803b0cc1b89bbd73986ad3101bd2bf929ee0

SHA512
5dd4247e06e942bc31670f99a500f511928553b7f719e344423953cd58ab77e4074ed0a375e09444a0124882936dc1ae854dcf1acd3396a31b23b444597e76bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
445aa3db0d59f3ca3242410e3b8f5106

SHA1
b749383e4bc03f75bc8a43d802e2d577dfe1f37d

SHA256
369b9e612ef1bb4d9503b74033199f2dc77e3f1d857f3ed02edaba90e8094d56

SHA512
337832de4e2988bb5d911877caacd82733639ab5d93b0f6ed843837bcc2a8612812a3f6fb03278176bca0de8d3386e749df1cb925656a01ca8e0fc40e4051743

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0643c245484fb9146201eb30ff5fe906

SHA1
9afc48d37873341fd770c28a56e920b3cff732cb

SHA256
e6eaa6dd83b7be1a5c8d97152ba4ce00b0ab1a41bfd58a7a2a8e0ad2e43aa91f

SHA512
f3893cc50e66d42ee5d7065a3939fe2efdb4c1f9ec219a7008451c0d10bc24d8d16e2254936cdd309b2a72e0ae398f0e4003d83b0a578d7c0e9ae7f79fb24e2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6c18f711f7160b3672fb35d4f1f2484

SHA1
af5920cc1e6985b7b44c66fe307d4d39f1660e45

SHA256
7850317d1c318aecab69453e3155f9b46b9286de361403e51d02271e4727728d

SHA512
b07f999b5f0295924f87200709920f318d1fe99ef7342f37f198e0b57fef432729455b27467d5ad21b33899f3db1d705b8153c3d7d754c04e42bb7b2a3a1c6f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08466def455fdb0274d3929ea5726d5d

SHA1
47db7cb13df7e579c4123c8c5257b7fb06bc2873

SHA256
0c84b888e1e4af665d69a5a9a2dba37861923e7784c6bc2c9c9de89e3adaee51

SHA512
d677aa7131c08b40bdcb499b4bc9356fcd6666382d9510f676d2c97b8ee850dfe102c94c5f3f8756d7b8ffe5c4cc938fce4b8fef1785997461045d790ae65d41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5900b1f585914b07da362fc851a69649

SHA1
5b28b296fcb35945ab6f7ae3ee36bb6bccd2a77a

SHA256
74e76bdd942e0b564d8d425ce1cbe962e7cc8562b6f9cf1c34ff409579a777f4

SHA512
b9ad4cd8ef0e85cd55ffc4f728baa3332d5269eadc41518e3ace35351e81cdd5803b3457e90aaadfaebb4769b7b9da78cfc420f91cf5dd894b40bd21c10f8f98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1e0782d625d0b239f97867ad3aa963e

SHA1
14b822331fa287a1aa0120f92700bb079c619a78

SHA256
1be157e376232253c2fdd04625813b648d4819d04552cb04bdb264aceb13baae

SHA512
773c69a4017274d1612e5df6c8c68e3ddf9bbe998f61df657f037d0b548c93f87bdbcdf8aba0e2a2a970974fc5ddfeb8b1bc65da6e3185c2c62e46f7cb55e69a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5393c29aca80a2f8ccc63988bdfd4fbb

SHA1
a503df4e7c65724f2c3a61810e31b02e3d1ff660

SHA256
a386348eafb416c34863ed0fae82d20a844bee9d0ac26b886cbc17cdd299d461

SHA512
1fe67a3120c6a5d4798f9f7bf9159c243b65f81ba9e55e8c5200fe11930ed4cffe202e0f8576332bd9cbf07d0eadc8465417b5030d74ec20c1a594860948b6c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2D69.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3231.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit